Welcome back, everyone.
This is a niche and this is yet another wonderful session on information gathering for sure, but this
way, this time will be making use of SCDP enumeration.
Now, what exactly does the end map?
We can perform the entire application scanning just with one command.
I like to like open vast Nessus, where you have to go to the command line, you know, the Web, they're
using the graphical user interface and you have to select multiple options and all this stuff.
Then map moppets quick.
You just have to start a couple of commands and you're good to go.
Remember, with SCDP information, what we have been doing earlier, we have done, in fact, earlier,
though, to gather information, the intrusted file, the potentially risky file, what we have done
with the DIA busters and any information, any information gathering tools as well that we have done
with reconning and Nessa's scanners, open maps as well.
We can do all of them with S2P being operation.
It actually scan basically performed the spidering of the entire Web application and delu of under reports
about what are the directories or one of the folders are basically explode.
So you are open.
So it can tell you this is the interesting file.
This is the interesting directory basically.
And then you can possibly possibly try and looking into it being a hacker.
Right.
So let's get started again.
Will have to get back to work machine.
And at this time with this data, we go to Autogen, which is over here last BWV.
And well, as you already know, if you are following me thoroughly, it's on tendency toward one doctor
that's over with this, but very aware of SPW.
We basically being close.
That's a broken Web application.
And let's try it on the script.
Name is SCDP Inam.
What all you would need to do is you simply have to.
Uh, you can make the script.
Debbie, and then you can straight over to find the IP address if you want.
Right.
So that's that's pretty quick, right, that there's nothing you have to go doing it.
Try and wait for us again and let's see what the response comes back.
Lovely.
Now what we get, we get to see what other ports open on the on the server, there's 20 to Bordewich
is such a system, just four and waterlogging to the devices and eighty four.
Of course, there are some more as well.
One three nine one forty three four four three which is a steeps.
These are open and if you see there is an SCDP numeration has been done and it finds that what press
folder is available, which is the blogsite, this page, this and this and all the stuff, it was Domenik,
some of which is you get the information as well.
And this is the idea.
You might get the get the point about right.
We most of us, if the site is a WordPress, most of us know that we can log into the WordPress as an
admin if we have the current arrangement with the WP login that PSP, which is usually with the same
login page itself.
And there are some interesting folders available as well, potentially interesting folders under this
directory.
CGI bin and icons are available here and images as well.
And again, there are some more Apache Tomcat FAWZY four are not unauthorized.
There's Docs folders available as well.
Potentially intrusted folder where?
Why potentially interesting because this is where this is can be can be explored to see.
Is there any backfills or denigrations file has been stored, any old file or all the stuff.
Right.
So this is what we could probably do now if if you, if you want to see any specific directory itself.
Right.
Or maybe you see this over SBW, a broken web application is hosting multiple application in Third-rate
and every application is get is actually into a different directory altogether.
So if you just want to be focused on a specific application, which is a part of a specific directory,
and let me show you how if let's say I want to reach out to this application, I just want to open it
with the moment you click on it, you see the difference.
It's basically in a different directory all together.
So when somebody you want to access it, they should be knowing not just the host IP address, but also
the directory as well in order to access to mutely.
And I'm not sure if that's the way it has to be pronounced, but it's pretty weird.
Yeah.
So that's what we can go for.
And let's say if you want to get get into it, what are you going to do.
You can make use of, of.
Yeah, you can make use of a base but you can define the directory as well if you would like to go in
much more detail.
So this even be applicable for any sort of scanning you might perform for it now.
Right.
What do you need to do is you need to define script and arguments with it and you basically have to
define the base path and with this sorry base path.
And that's where you basically define what is the director you're looking for.
You specify what the director's slash.
That's the key to the right.
OK.
All right, so that's done.
And yeah, and then you define your target.
So then zeroed out one 12.
All right.
So it looks pretty good, if not, than we are expected to have an error for sure.
So now what what do you think?
What's going to happen in this?
You have seen the generic, you know, details about the entire site, irrespective of a specific domain.
But you when when when you are specific about a specific application in our case at this, then you
would see all the details specific to this application only.
Look at Endor and let's see what comes.
Lovely.
You see, this is all related with the same application and yeah, so you probably can get the better
idea and probably can get the insight about how how it would really make sense to you.
It's pretty pretty much looking scene in a way about what the directory and other readers it is.
And that's how we can go in detail and look into a specific directory and specific information about
either the entire site or probably the directory itself.
All right.
So I hope this was helpful for you.
Will catch in the next edition.
And thank you.